M3b review fixes by the design model: curl --globoff, podman --pull=never

Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/toolkit/tests/fetch.rs

@@ -39,8 +39,10 @@ fn args() -> HttpFetchArgs {
 #[test]
 fn the_argument_list_is_fixed_and_ends_with_the_url() {
     let expected: Vec<&str> = vec![
+        "--disable",
         "--silent",
         "--show-error",
+        "--globoff",
         "--proto",
         "=https",
         "--proto-redir",